o
    Žõ±jÛ  ã                   @   sJ   d dl Z d dlZd dlmZ d dlmZ G dd„ dƒZG dd„ deƒZdS )é    N)ÚPackageDecryptor)ÚDPAPIc                   @   s4   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ ZdS )ÚCloudapCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )NÚcloudap)ÚcredtypeÚluidÚsidÚcachedirÚPRTÚkey_guidÚ	dpapi_keyÚdpapi_key_sha1©Úself© r   ú£/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/cloudap/decryptor.pyÚ__init__   s   
zCloudapCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r	   r
   r   r   r   )r   r	   r
   r   r   r   ©r   Útr   r   r   Úto_dict   s   





zCloudapCredential.to_dictc                 C   s   t  |  ¡ ¡S ©N)ÚjsonÚdumpsr   r   r   r   r   Úto_json   s   zCloudapCredential.to_jsonc                 C   s   t | jtƒr| j ¡ S | jS r   )Ú
isinstancer   ÚbytesÚhexr   r   r   r   Úget_masterkey_hex   s   z#CloudapCredential.get_masterkey_hexc                 C   sV   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d|  ¡  7 }|d| j 7 }|S )Nz	== Cloudap [%x]==
z		cachedir %s
z			PRT %s
z		key_guid %s
z		dpapi_key %s
z		dpapi_key_sha1 %s
)r   r	   r
   r   r   r   r   r   r   r   Ú__str__!   s   
zCloudapCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   r   r      s    

r   c                       s4   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Z‡  ZS )	ÚCloudapDecryptorc                    s"   t ƒ  d|||¡ || _g | _d S )NÚCloudap)Úsuperr   Údecryptor_templateÚcredentials)r   Úreaderr%   Úlsa_decryptorÚsysinfo©Ú	__class__r   r   r   +   s   
zCloudapDecryptor.__init__c                 C   s8   |   d| jj¡}| j || jj ¡}| j |¡}||fS )NzcloudAP.dll)Úfind_signaturer%   Ú	signaturer'   Úget_ptr_with_offsetÚfirst_entry_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entry0   s   z!CloudapDecryptor.find_first_entryc              
   C   sZ  z’t ƒ }|j|_|jd u s|jjdkrW d S |j | j¡}|j d¡ 	dd¡|_
|jdkrT|jjdkrT| j|j | j|j¡ddd�\}}z| ¡ }W n   Y t|ƒ|_|jdkr}|j | j¡}|d ur}|jj|_| j|jdd�\|_}t |j¡ ¡ |_|jd u rŠ|jd u rŠW d S | j |¡ W d S  ty¬ } z|  d	| ¡ W Y d }~d S d }~ww )
Nr   z	utf-16-leú Ú Té   )Úbytes_expectedÚsegment_size)r8   z&CloudAP entry parsing error! Reason %s)r   ÚLocallyUniqueIdentifierr   Ú
cacheEntryÚvalueÚreadr'   ÚtonameÚdecodeÚreplacer	   ÚcbPRTr
   Údecrypt_passwordÚread_rawÚstrÚtoDetermineÚguidr   Úunkr   ÚhashlibÚsha1Ú	hexdigestr   r&   ÚappendÚ	ExceptionÚlog)r   Úcloudap_entryÚcredÚcacheÚtempÚraw_decrG   Úer   r   r   Ú	add_entry6   s6   "


€ÿzCloudapDecryptor.add_entryc              
   C   sr   z|   ¡ \}}W n ty" } z|  d| ¡ W Y d }~d S d }~ww | j |¡ | j | j¡}|  || j¡ d S )Nz"Failed to find structs! Reason: %s)	r4   rL   rM   r'   Úmover%   Ú
list_entryÚ	walk_listrT   )r   Úentry_ptr_valueÚentry_ptr_locrS   Ú	entry_ptrr   r   r   ÚstartW   s   €þzCloudapDecryptor.start)r   r    r!   r   r4   rT   r[   Ú__classcell__r   r   r*   r   r"   *   s
    !r"   )r   rH   Ú%pypykatz.lsadecryptor.package_commonsr   Úpypykatz.dpapi.dpapir   r   r"   r   r   r   r   Ú<module>   s    $